Motor control device

ABSTRACT

This motor control device is provided with a motor control unit which, on the basis of an operation command signal for driving the motor and a feedback signal from the encoder corresponding to motor operation, generates a command value relating to operation of the motor in accordance with a prescribed feedback method such that operation of the motor follows the operation command signal. Interruption processing of the drive signal is performed on the basis of the comparison result of a prescribed feedback value, which is calculated from the feedback signal from the encoder, and a control calculation value, which, comparable with a prescribed feedback value, is calculated during the process of generation of the command value by the motor control unit. By means of this configuration, it is possible to improve safety performance of the motor control device without hampering the safety performance of the encoder.

TECHNICAL FIELD

The present invention relates to a motor control device that drives andcontrols a motor.

BACKGROUND ART

In recent years, a servo system has been used for, for example,positioning control of operating units in various machines atmanufacturing sites. An example of such a servo system includes a systemincluding a servo motor for operating various mechanical devices, anencoder attached to the servo motor, a servo driver for driving theservo motor, and a control device for outputting a position commandinformation or the like to the servo driver. Efforts to ensure thesafety of workers together with cost reduction and improvement inproductivity are becoming important requirements at manufacturing sites.Therefore, a servo system is also required to be suitable forcorresponding safety standards.

Here, Patent Literature 1 discloses a safety unit that outputs a stopsignal for stopping a servo motor to a servo driver when a failureoccurs. Specifically, the safety unit is configured to output the stopsignal when a determination is made that any one of a value of anoperation command signal from a control device to the servo motor, avalue of a feedback signal from an encoder, and a determination valuecalculated from both of the values fails. With such a configuration, itis possible to achieve safety of a servo system. Further, PatentLiterature 2 discloses a system configuration that outputs an alarm in acase in which position information from an encoder in a system hasshifted between before and after the power of a servo system is switchedON when the power of the servo system is switched from OFF to ON forreplacement of a command unit including the encoder. With thisconfiguration, appropriate replacement work for the command unit issecured.

CITATION LIST Patent Literature [Patent Literature 1] Japanese PatentNo. 5367623 [Patent Literature 2] Japanese Patent No. 4261320 SUMMARYTechnical Problem

In the related art, in a motor control device that drives and controls amotor, it has been considered that it is necessary to enhance the safetyperformance of an encoder that detects a movement of the motor thatgenerates input information for the motor control device in order toenhance the safety performance of the motor control device. Therefore,it is necessary for requirements of predetermined safety standards to besatisfied in design of an encoder. For example, IEC 61508 is defined assuch a safety standard. IEC 61508 is an international standard forfunctional safety of electrical, electronic and programmable electronicsafety-related systems. In IEC 61508, a probability of failure of asystem is defined by a measure called Safety Integrity Level (SIL) asshown in Table 1 below.

TABLE 1 Safe Failure Hardware Fault Tolerance (HFT) Fraction (SFF) 0 1 2<60% Not allowed SIL1 SIL2 60%-<90% SIL1 SIL2 SIL3 90%-<99% SIL2 SIL3SIL4 ≥99% SIL3 SIL4 SIL4

The IEC 61508 defines requirements to be satisfied for each SIL in thetable, and initiatives to be achieved by a safety control system to beconstructed are clarified. The SILs are divided into the four stagesSIL1 to SIL4, and a greater value of SIL indicates a higher safetyperformance. It is inevitably necessary for an SIL of an encoder to beadopted to be increased in order to increase the value of the SILregarding the motor control device. This leads to an increase in costsfor the encoder or an increase in a size of the encoder due to, forexample, the necessity of adopting a special interface, and impairsconvenience in design of the motor control device.

The present invention has been made in view of such problems, and anobject of the present invention is to provide a technology for enhancingthe safety performance of a motor control device regardless of thesafety performance of an encoder.

Solution to Problem

In the present invention, in order to solve the above problems, acontrol calculation value calculated by a motor control device itself,in addition to a feedback value calculated by a feedback signal from anencoder corresponding to a motor, is also adopted as input informationfor securing safety performance of a motor control device. With such aconfiguration, it is possible to enhance safety performance of the motorcontrol device regardless of safety performance of the encoder.

Specifically, the present invention is a motor control device fordriving a motor having an encoder that detects an operation of themotor, and includes a motor control unit that generates a command valueregarding the operation of the motor according to a predeterminedfeedback scheme so that the operation of the motor follows an operationcommand signal for driving the motor on the basis of the operationcommand signal and a feedback signal from the encoder corresponding tothe operation of the motor; a drive unit that supplies a drive currentfor driving the motor to the motor according to the command value fromthe motor control unit; an interruption unit that interrupts transfer ofa drive signal accompanying the command value from the motor controlunit to the drive unit; and a safety control unit that executes aninterrupting process of the drive signal via the interruption unit whena determination is made that a failure has occurred in driving of themotor. The safety control unit executes the interrupting process of thedrive signal in the interruption unit on the basis of a result ofcomparing a predetermined feedback value that is calculated by thefeedback signal from the encoder with a control calculation value thatis calculated in a process in which the motor control unit generates thecommand value and is comparable with the predetermined feedback value.

The motor control device according to the present invention is a devicethat drives the motor on the basis of the operation command signal, anda servo driver, an inverter, or the like can be illustrated as the motorcontrol device. It should be noted that the operation command signal maybe generated by another control device (a PLC or the like) locatedoutside the motor control device and provided to the motor controldevice, or may be generated inside the motor control device.Specifically, the motor control unit generates a command value fordriving the motor according to a predetermined feedback scheme from theoperation command signal and the feedback signal from the encoder. Bytransferring a drive signal with the command value from the motorcontrol unit to the drive unit, the drive unit supplies a drive currentaccording to the command value to the motor, and the motor is driven tofollow the operation command signal. It should be noted that, for thepredetermined feedback scheme, any feedback scheme can be adopted aslong as the motor can be driven to follow the operation command signal.For example, a feedback scheme regarding position information, speedinformation, or the like can be adopted.

Here, the motor control device includes the interruption unit thatinterrupts transfer of the drive signal from the motor control unit tothe drive unit, and the safety control unit controls the interruptingprocess of the drive signal through the interruption unit. When adetermination is made that a failure has occurred in driving of themotor, the safety control unit executes the interrupting process torealize the safety performance of the motor control device. Theinterrupting process executed by the safety control unit includes aninterrupting process that is executed on the basis of a result of acomparison between the control calculation value calculated in theprocess in which the motor control unit generates the command value andthe feedback value from the encoder. The control calculation value is aparameter value that is comparable with the feedback value from theencoder, and an example thereof includes a parameter regarding the samephysical quantity as a physical quantity (for example, a position orspeed) corresponding to the feedback value from the encoder. Further,the feedback value is a value that is calculated by the feedback signalfrom the encoder, and examples thereof include an information valueregarding a position of the motor and an information value regarding aspeed of the motor.

As described above, the interrupting process is an aspect in which notonly the feedback value itself from the encoder, but also the controlcalculation value calculated in the process in which the motor controlunit generates the command value is adopted as input information forinterrupting of the drive signal for securing the safety performance ofthe motor control device. Therefore, in the above motor control device,diversification of the input information for securing the safetyperformance of the motor control device is achieved, and thus, it ispossible to enhance the safety performance of the motor control deviceregardless of the safety performance of the encoder. That is, bydiversifying the input information, it is possible to increase a valueof hardware fault tolerance (HFT), and thus, it is possible to increasea value of the SIL regarding the safety performance of the motor controldevice as compared with the value of an SIL regarding the safetyperformance of the encoder (it is understood from Table 1 above that thevalue of the SIL is increased when the HFT is increased in a state inwhich the SFF is maintained).

It should be noted that the safety control unit may make a failuredetermination for restriction of a speed or position of the motor usingthe feedback value from the encoder as another interrupting process, andperform interrupting of the drive signal according to a result of thedetermination.

Here, in the motor control device, the encoder may be configured togenerate two independent feedback signals in response to the operationof the motor, and the safety control unit may compare each of the twopredetermined feedback values calculated from the two feedback signalswith the control calculation value and compare the two predeterminedfeedback values to execute the interrupting process of the drive signalin the interrupting process. With such a configuration, the interruptingprocess based on diversified input information is performed by using aresult of a comparison between the duplexed feedback control signal fromthe encoder and the control calculation value. Accordingly, it ispossible to increase a value of the SIL regarding the safety performanceof the motor control device as compared with the value of the SILregarding the safety performance of the encoder.

Here, a specific example of the interrupting process in the safetycontrol unit in the motor control device described above is disclosed.First, the safety control unit may determine whether or not to executethe interrupting process on the basis of a difference between thepredetermined feedback value and the control calculation value in theinterrupting process. Further, second, the safety control unit maycompare a proportional change of the predetermined feedback value with aproportional change of the control calculation value to determinewhether or not to execute the interrupting process on the basis of aresult of the comparison in the interrupting process. Further, third,the safety control unit may determine whether or not to execute theinterrupting process on the basis of a proportional change of adifference between a proportional change of the predetermined feedbackvalue and a proportional change of the control calculation value in theinterrupting process. Further, as the interrupting process in the safetycontrol unit, a process obtained by combining some or all of these maybe adopted, or alternatively, a process other than the above-describedprocess may be adopted.

Further, in the motor control device described above, a safety circuitboard in which the safety control unit is formed may be removable fromthe main body side of the motor control device in which the motorcontrol unit, the drive unit, and the interruption unit are formed, andthe safety circuit board may be removed from the motor control device,and another circuit board in which another safety control unit thatexecutes the interrupting process of the drive signal through theinterruption unit when a determination is made that a failure hasoccurred in driving of the motor, which is different from the safetycontrol unit, has been formed may be able to be incorporated in themotor control device, instead of the safety circuit board. Since thesafety circuit board forming the safety control unit is configured to beremovable from the main body side of the motor control device, anothercircuit board forming another safety control instead of the safetycontrol unit described above can be incorporated in the motor controldevice, as necessary. Accordingly, it is possible to suitably provide amotor control device having a safety performance according to a demandto a user.

Advantageous Effects of Invention

It becomes possible to enhance safety performance of the motor controldevice regardless of safety performance of the encoder.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a first diagram illustrating a schematic configuration of aservo system in which a servo driver according to the present inventionis incorporated.

FIG. 2 is a diagram schematically illustrating safety performance in asubsystem of a servo driver according to the present invention.

FIG. 3 is a first functional block diagram of the servo driver accordingto the present invention.

FIG. 4 is a flowchart of an interrupting process that is executed by theservo driver according to the present invention.

FIG. 5 is a second functional block diagram of the servo driveraccording to the present invention.

FIG. 6 is a functional block diagram of an inverter according to thepresent invention.

DESCRIPTION OF THE EMBODIMENTS Example 1

FIG. 1 is a schematic configuration diagram of a servo system in which aservo driver corresponding to a motor control device of the presentinvention is incorporated. The servo system includes a network 1, amotor 2, an encoder 3, a servo driver 4, a standard programmable logiccontroller (PLC) 5, and a safety PLC 6. The motor 2 and the encoder 3form a servo motor. The servo system is a system for driving the motor2, and the motor 2 is incorporated in various mechanical devices (forexample, an arm and a conveying device of an industrial robot) (notillustrated) as an actuator for the devices. For example, the motor 2may be an AC motor. The encoder 3 is attached to the motor 2 in order todetect an operation of the motor 2. The encoder 3 generates a feedbacksignal indicating the detected operation of the motor 2 and transmitsthe feedback signal to the servo driver 4. The feedback signal includes,for example, positional information on a rotational position (angle) ofa rotational shaft of the motor 2, and information on a rotational speedof the rotational shaft. A general incremental encoder or absoluteencoder can be applied to the encoder 3.

The servo driver 4 receives an operation command signal regarding anoperation (motion) of the motor 2 from the standard PLC 5 through thenetwork 1, and receives the feedback signal output from the encoder 3.The servo driver 4 executes servo control on the driving of the motor 2on the basis of the operation command signal from the standard PLC 5 andthe feedback signal from the encoder 3. Further, the servo driver 4 isalso connected to the safety PLC 6 via the network 1. Accordingly, theservo driver 4 performs monitoring of occurrence of a failure in themotor 2 or the servo driver 4 on the basis of the monitoring commandsignal received from the safety PLC 6, and sends a result of monitoringto the safety PLC 6.

Further, the servo driver 4 calculates a command value regarding theoperation of the motor 2 on the basis of the operation command signalfrom the standard PLC 5 and the feedback signal from the encoder 3.Further, the servo driver 4 supplies a drive current to the motor 2 sothat the operation of the motor 2 follows the command value. It shouldbe noted that AC power to be sent from the AC power supply 11 to theservo driver 4 is used for the supplied current. In the example, theservo driver 4 is of a type that receives a three-phase AC current, butmay be of a type that receives a single-phase AC current.

Here, FIG. 2 is a block diagram of a safety function in an inputconfiguration, an arithmetic configuration, and an output configurationthat are three subsystems constituting the servo driver 4 when the servodriver 4 is one system. The input configuration is a subsystem regardingan input to the servo driver 4, and the safety performance thereofgreatly depends on the safety performance of the encoder 3.Specifically, the encoder 3 has a circuit duplexed to enable independentpulse output through simultaneously scanning inside the encoder 3 aswill be described below, and a duplexed feedback signal is input to theservo driver 4 via an independent wiring. Therefore, the inputconfiguration includes safety functions InS01 and InS02 due to theencoder 3, and a hardware fault tolerance (HFT) in this case is 1.Further, as an alternative to setting the HFT of the input configurationto 1, communication regarding the input configuration may be duplexed.It should be noted that, in general, it is not easy to increase a safefailure fraction (SFF) of the encoder from the viewpoint of a volume (asize) or price of the encoder, and thus, the SFF of the encoder 3 isassumed to be relatively low and be in a range of 60% or more and lessthan 90%. In the input configuration, when the safety performancedepends only on the encoder 3, a safety level (SIL) of the inputconfiguration is 2.

The arithmetic configuration is a subsystem regarding arithmetic forcalculating an output from an input in the servo driver 4, and hassafety functions CtS01 and CtS02, for example, due to independentlyduplicating an arithmetic circuit using a microprocessor (MPU). In thiscase, the HFT is 1. Further, in general, it is easy to make the SFF ofthe arithmetic configuration relatively high, and thus, the SFF of thearithmetic configuration is relatively high and in a range of 90% ormore and less than 99%. Therefore, the SIL of the arithmeticconfiguration is 3. Further, the output configuration is a subsystemregarding an output from the servo driver 4 and depends on the safetyperformance of the interruption unit 43 that interrupts the transfer ofthe drive signal from the motor control unit 42 to the drive unit 44, aswill be described below. Specifically, the output configuration hassafety functions OtS01 and OtS02 due to independently duplicating anelectric circuit forming the interruption unit 43. In this case, the HFTis 1. Further, in general, it is easy to make the SFF of the outputconfiguration relatively high, and thus, the SFF in the arithmeticconfiguration is assumed to belong to a range of relatively high 90% ormore and less than 99%. Therefore, the SIL of the output configurationis also 3.

Thus, in the servo driver 4, in a case in which the safety performanceof the input configuration depends only on the encoder 3 and when thesafety level is low (the SIL is 2), the safety performance of the entiresystem is also low due to an influence of the safety level and,specifically, the SIL of the servo driver 4 also becomes 2. Therefore,in the servo driver 4, a new signal is additionally adopted in additionto the feedback signal from the encoder 3 while the configuration of theencoder 3 remains the same, such that safety performance InS03 (see FIG.2) is added to the input configuration and the HFT of the inputconfiguration is 2. In a case in which the SFF of the inputconfiguration belongs to a range of 60% or more and less than 90% evenwhen the safety performance InS03 is added, the SIL of the inputconfiguration is 3 as indicated by a white arrow in FIG. 2. As a result,considering that the SILs of the arithmetic configuration and the outputconfiguration are 3, the SIL of the servo driver 4 can be set to 3, andthe safety performance of the servo driver 4 can be enhanced. That is,it is possible to enhance the safety performance of the servo driver 4regardless of the safety performance of the encoder 3 itself and, inother words, it is possible to enhance the safety performance of theservo driver 4 inexpensively while maintaining the safety performance ofthe encoder 3 itself.

Hereinafter, a more specific configuration of the servo driver 4 will bedescribed. FIG. 3 is a functional block diagram of the servo driver 4.As illustrated in FIG. 3, the servo driver 4 includes a feedbackprocessing unit 41, a motor control unit 42, an interruption unit 43, adrive unit 44, and a safety control unit 50. It should be noted that,although the following description will be focused on the inputconfiguration of the servo driver, it is assumed that the respectiveHFTs are 1 as illustrated in FIG. 2 for the arithmetic configuration andthe output configuration. First, the feedback processing unit 41generates a feedback value on the basis of the feedback signal from theencoder 3. For example, when a pulse is output from the encoder 3, thefeedback processing unit 41 counts this pulse to calculate a rotationalposition or a rotational speed of a rotation shaft of the motor 2, andgenerates a feedback value including a value indicating the position orthe speed.

It should be noted that the encoder 3 has a circuit duplexed to enableindependent pulse output by simultaneously performing scanning in theencoder 3, and outputs a duplexed feedback signal. Therefore, thefeedback processing unit 41 receives the duplexed feedback signal fromthe encoder 3 and generates a duplexed feedback value on the basis ofthe feedback signal. The feedback processing unit 41 sends the generatedduplexed feedback value to the motor control unit 42 and also to thesafety control unit 50.

Next, the motor control unit 42 receives the operation command signalfrom the standard PLC 5 and receives the feedback value from thefeedback processing unit 41. The motor control unit 42 generates acommand value for executing position feedback control and speed feedbackcontrol on the basis of the operation command signal and the feedbackvalue. It should be noted that a feedback scheme to be adopted in thefeedback control is a scheme in which a servo loop suitable for apredetermined purpose (for example, conveyance of packages) of amechanical device (for example, a conveyance device) in which the motor2 is incorporated is formed, and can be appropriately designed. Thesecommand values generated by the motor control unit 42 are sent as drivesignals to the interruption unit 43. Further, a position command valueand a speed command value calculated in a process in which the motorcontrol unit 42 generates a command value are sent to the safety controlunit 50 as the control calculation value P1. The control calculationvalue P1 is added to a determination process in the determination unit51 of the safety control unit 50, as will be described below.

Next, when the interruption unit 43 receives an interrupting signal fromthe safety control unit 50 to be described below, the interruption unit43 stops the drive unit 44 not by electrically passing the drive signalfrom the motor control unit 42 to the drive unit 44 to be describedbelow. Accordingly, even when the motor control unit 42 transmits thedrive signal, the output of the torque in the motor 2 is stopped. On theother hand, when the interrupting signal is not input to theinterruption unit 43, the interruption unit 43 passes the drive signalwith a command value output from the motor control unit 42 to the driveunit 44 as it is.

Here, the drive unit 44 receives the drive signal from the motor controlunit 42 via the interruption unit 43. The drive unit 44 includes, forexample, a circuit including a semiconductor switching element such asan insulated gate bipolar transistor (IGBT), and generates a signal forturning on or off the switching element according to a PWM scheme on thebasis of the drive signal from the motor control unit 42, and turns onor off the switching element according to this signal. Accordingly, ACpower is supplied to the motor 2 and the motor 2 is driven according tothe drive signal. On the other hand, when the interruption unit 43operates and the transfer of the drive signal to the drive unit 44 isinterrupted, the output from the drive unit 44 is fixed to OFF.Accordingly, since the power supply to the motor 2 is stopped, theoutput of the torque from the motor 2 is stopped.

Thus, the feedback processing unit 41, the motor control unit 42, theinterruption unit 43, and the drive unit 44 are so-called functionalunits directly related to the drive control of the motor 2. On the otherhand, the safety control unit 50 is a functional unit that determinesoccurrence of a failure in the servo driver 4 regarding an operation ofthe motor 2, and stops the operation of the motor 2 to ensure safety forthe operation when a determination is made that the failure hasoccurred. Specifically, the safety control unit 50 includes adetermination unit 51 and an interrupting instruction unit 52. Controlregarding safety ensuring including a failure determination in thesafety control unit 50 is executed on the basis of a monitoring commandfrom the safety PLC 6.

The determination unit 51 is a functional unit that determines whetheror not a failure related to the operation of the motor 2 has occurred.The determination is performed on the basis of a feedback value linkedwith the operation of the motor 2 or a command value for operating themotor 2. Specifically, the determination unit 51 receives the duplexedfeedback value from the feedback processing unit 41 and receives thecontrol calculation value P1 from the motor control unit 42.

Next, a failure determination based on the control calculation value P1and the feedback value will be described. Here, the control calculationvalue P1 is a value of a parameter that is comparable with the feedbackvalue, that is, a position command value and a speed command value. Forexample, when the feedback value sent from the feedback processing unit41 to the safety control unit 50 is a value regarding a speed of themotor 2, the control calculation value P1 is a speed command value ofthe motor 2 that is calculated in a process in which the motor controlunit 42 generates a command value according to a predetermined feedbackscheme.

Further, when the feedback value is a value regarding a position of themotor 2, the control calculation value P1 is a position command value ofthe motor 2 that is calculated similarly. It should be noted that whenthe feedback value is a value regarding the speed and the position ofthe motor 2, the control calculation value P1 is both the speed commandvalue and the position command value of the motor 2.

The determination unit 51 compares the control calculation value P1 withthe two feedback values. Specifically, the determination unit 51additionally receives the control calculation value P1 as a new feedbackvalue, in addition to the two feedback values from encoder 3. Therefore,the determination unit 51 receives three signals having the same qualityas the feedback value. In order to confirm validity of all the signals,the determination unit 51 determines whether or not a difference betweentwo of the three signals is in an allowable range with respect to allcombinations of the two signals. When the difference in each combinationdeviates from the allowable range, this means that the feedback signalthat is an input from the encoder 3 to the servo driver 4 and anoriginal operation state of the servo motor deviate from each other and,therefore, a reasonable determination can be made that any failure hasoccurred. That is, the determination unit 51 can compare the controlcalculation value P1 with the two feedback values to determine thevalidity of the signal corresponding to each value. Further, as analternative to a rational failure determination, a proportional changeof the control calculation value P1 may be compared with a proportionalchange of the feedback value to determine whether or not a differencebetween the two proportional changes is in an allowable range.

Further, a determination may be made as to whether or not a proportionalchange of the difference between the two proportional changes is in theallowable range or any combination of these failure determinationaspects may be adopted.

Thus, the determination unit 51 determines validity of each signal usingthree signals obtained by adding the control calculation value P1 to thetwo feedback values. When the determination unit 51 determines that atleast one of the signals is not valid, an interrupting signal isgenerated by the interrupting instruction unit 52 and the generatedinterrupting signal is sent to the interruption unit 43. Theinterruption unit 43 that has received the interrupting signalinterrupts the transfer of the drive signal from the motor control unit42 to the drive unit 44 as described above, thereby stopping a torqueoutput from the motor 2. It should be noted that the safety PLC 6 isnotified of such a control state (presence or absence of the failure) inthe safety control unit 50 in the form of an answer to the monitoringcommand from the safety PLC 6.

An interrupting process of the safety control unit 50 including thedetermination unit 51 and the interrupting instruction unit 52 will bedescribed on the basis of FIG. 4. The interrupting process illustratedin FIG. 4 is repeatedly executed, for example, at a control cycle (forexample, 2 msec) in which the command value is generated by anarithmetic device (an MPU or the like), which forms the safety controlunit 50. In S101, the determination unit 51 acquires, from the motorcontrol unit 42, the control calculation value P1 calculated in aprocess in which the motor control unit 42 generates the command value.Then, in step S102, the determination unit 51 compares the controlcalculation value P1 with the two feedback values and determines whethera difference between these is outside an allowable range. That is, adetermination is made as to whether or not each of a difference betweenthe control calculation value P1 and one feedback value, a differencebetween the control calculation value P1 and the other feedback value,and a difference between the two feedback values is outside theallowable range. When at least one of the differences is outside theallowable range, a positive determination is made in S102.

When the positive determination is made in step S102 and the processproceeds to step S103, an interrupting signal is generated by theinterrupting instruction unit 52 and the generated interrupting signalis sent to the interruption unit 43 in step S103. Accordingly, thetorque output from the motor 2 is stopped. Further, when a negativedetermination is made in S102, the interrupting instruction unit 52 doesnot perform the generation of the interrupting signal and theinterrupting process ends.

Thus, in the servo driver 4, the two feedback values from the encoder 3are added, the control calculation value P1 is compared with the twofeedback values by the determination unit 51, the determination as tothe validity of each signal is performed, and the torque output from themotor 2 is stopped by the operation of the interruption unit 43 when adetermination is made that the signal is not valid. That is, in theservo driver 4, it is possible to increase the HFT regarding the inputconfiguration of the servo driver 4 from 1 to 2 by increasing the numberof substantial signals that are targets of the determination as to thevalidity of the input signal in the input configuration. When the SFF ofthe input configuration belongs to the range of 60% or more and lessthan 90% after the failure determination is performed, the SIL of theinput configuration also is increased from 2 to 3 with the increase inthe HFT (See FIG. 2).

Further, the determination unit 51 can also perform a failuredetermination other than the failure determination as to the feedbacksignal, which is the input signal from the encoder 3 described above.For example, each of the two feedback values received from the feedbackprocessing unit 41 is compared with an upper limit value set and storedin the safety control unit 50 in advance. When the feedback valueexceeds the upper limit value, this means that an actual operating stateof the servo motor deviates from an original operating state of theservo motor, and therefore, a reasonable determination can be made thatany failure has occurred. It should be noted that the upper limit valueis a value corresponding to, for example, speed limit (SLS) or positionlimit (SLP) that is a known failure determination.

Example 2

A functional configuration of the servo driver 4 of the presentinvention will be described on the basis of FIG. 5. Among functionalunits illustrated in FIG. 5, functional units substantially the same asthe functional units illustrated in FIG. 3 are denoted by the samereference numerals and detailed description thereof will be omitted.

In the embodiment, a feedback processing unit 41, a motor control unit42, an interruption unit 43, and a drive unit 44, which are functionalunits directly related to drive control of the motor 2, are disposed onthe main body side of the servo driver 4. In this disposition, since thedrive unit 44 is disposed under a higher voltage environment than theother functional units, a known appropriate insulation process isperformed between the drive unit 44 and the other functional units. Onthe other hand, the safety control unit 50 is formed on the safetycircuit board 4A.

The circuit board 4A is configured to be removable from the main bodyvia a slot 4 a provided on the main body side of the servo driver 4.Therefore, when the circuit board 4A is incorporated in a main body ofthe servo driver 4 through the slot 4 a, electrical contacts between thecircuit board 4A and the main body of the servo driver 4 are designed sothat exchange of signals between the safety PLC 6 and the safety controlunit 50 is possible, so that the determination unit 51 can receive thefeedback value from the feedback processing unit 41 and the controlcalculation value P1 from the motor control unit 42, and so that theinterruption unit 43 can receive the interrupting signal from theinterrupting instruction unit 52.

Further, in the servo driver 4, another circuit board in which anothersafety control unit that executes the interrupting process of the drivesignal through the interruption unit 43 when a determination is madethat a failure has occurred in the driving of the motor 2, which isdifferent from the safety control unit 50, has been formed may beincorporated in the servo driver 4 in a state in which the circuit board4A has been removed. For example, another circuit board in which asafety control unit capable of executing only a failure determinationregarding speed limit (SLS), position limit (SLP), or the like has beenformed may be incorporated in the main body of the servo driver 4without making a failure determination as to the feedback signal, whichis an input signal from the encoder 3 described above. With thisconfiguration, it is possible to easily provide a user who does not needthat the SIL of the servo driver is 3 with a servo driver havingnecessary safety performance by using a common functional unit directlyrelated to the drive control of the motor 2.

Modification Example 1

Although the aspect in which the SIL of the input configuration as thesubsystem is 2 and the SIL of the arithmetic configuration and theoutput configuration is 3 has been illustrated in the embodimentdescribed above, the present invention can naturally be applied to otheraspects. For example, in an aspect in which the feedback signal is notduplexed, the SIL of the input configuration using an encoder withrelatively low safety performance is 1, and the SIL of the arithmeticconfiguration and the output configuration is 2, it is possible to setthe SIL of the servo driver according to the aspect to 2 regardless ofthe safety performance of the encoder by applying a failuredetermination of the feedback signal, which is the input signal from theencoder 3 and a process regarding interrupting according to the presentinvention in the input configuration.

Modification Example 2

Although the servo driver 4 as a motor control device of the presentinvention is illustrated in the above example, the inverter 40illustrated in FIG. 6 can also be adopted as the motor control device inplace of the aspect. It should be noted that an induction motor or thelike can be illustrated as the motor 2 driven and controlled by theinverter 40. FIG. 6 is a diagram illustrating functional blocks of theinverter 40. As illustrated in FIG. 6, the inverter 40 includes aplurality of functional units. Among the functional units, thefunctional units substantially the same as the functional units includedin the servo driver 4 illustrated in FIG. 3 are denoted with the samereference numerals, and detailed description thereof will be omitted.Specifically, the inverter 40 also includes a feedback processing unit41, a motor control unit 42, an interruption unit 43, a drive unit 44,and a safety control unit 50, and also includes an operation instructionunit 60.

The operation instruction unit 60 generates the operation command signalfor driving the motor 2 on the basis of a request operation given by theuser via an input device (not illustrated) in advance. Therefore, nooperation command signal is provided from an external device (forexample, the standard PLC 5) to the inverter 40, and the inverter 40drives and controls the motor 2 according to a predetermined feedbackscheme on the basis of the feedback signal from the encoder 3 and theoperation command signal from the operation instruction unit 60.Alternatively, the operation command signal may be provided from theexternal device to the inverter 40. In the inverter 40 configured inthis way, the two feedback values from the encoder 3 are added, thecontrol calculation value P1 is compared with the two feedback values bythe determination unit 51 included in the safety control unit 50, thedetermination as to the validity of each signal is performed, and thetorque output from the motor 2 is stopped by the operation of theinterruption unit 43 when a determination is made that the signal is notvalid, as in the servo driver 4 described above. As a result, in theinverter 40, it is possible to achieve improvement of the SIL of theinput configuration by increasing the number of substantial signals thatare targets of the validity determination as to the input signal in theinput configuration.

REFERENCE SIGNS LIST

-   -   1 Network    -   2 Motor    -   3 Encoder    -   4 Servo driver    -   4A Safety circuit board    -   4 a Slot    -   5 Standard PLC    -   6 Safety PLC    -   40 Inverter    -   41 Feedback processing unit    -   42 Motor control unit    -   43 Interruption unit    -   44 Drive unit    -   50 Safety control unit    -   51 Determination unit    -   52 Interrupting instruction unit

1. (canceled)
 2. (canceled)
 3. A motor control device for driving amotor having an encoder that detects an operation of the motor, themotor control device comprising: a motor control unit that generates acommand value regarding the operation of the motor according to apredetermined feedback scheme so that the operation of the motor followsan operation command signal for driving the motor on the basis of theoperation command signal and a feedback signal from the encodercorresponding to the operation of the motor; a drive unit that suppliesa drive current for driving the motor to the motor according to thecommand value from the motor control unit; an interruption unit thatinterrupts transfer of a drive signal accompanying the command valuefrom the motor control unit to the drive unit; and a safety control unitthat executes an interrupting process of the drive signal via theinterruption unit when a determination is made that a failure hasoccurred in driving of the motor, wherein the safety control unitexecutes the interrupting process of the drive signal in theinterruption unit on the basis of a result of comparing a predeterminedfeedback value that is calculated by the feedback signal from theencoder with a control calculation value that is calculated in a processin which the motor control unit generates the command value and iscomparable with the predetermined feedback value, wherein the safetycontrol unit determines whether or not to execute the interruptingprocess on the basis of a difference between the predetermined feedbackvalue and the control calculation value in the interrupting process. 4.A motor control device for driving a motor having an encoder thatdetects an operation of the motor, the motor control device comprising:a motor control unit that generates a command value regarding theoperation of the motor according to a predetermined feedback scheme sothat the operation of the motor follows an operation command signal fordriving the motor on the basis of the operation command signal and afeedback signal from the encoder corresponding to the operation of themotor; a drive unit that supplies a drive current for driving the motorto the motor according to the command value from the motor control unit;an interruption unit that interrupts transfer of a drive signalaccompanying the command value from the motor control unit to the driveunit; and a safety control unit that executes an interrupting process ofthe drive signal via the interruption unit when a determination is madethat a failure has occurred in driving of the motor, wherein the safetycontrol unit executes the interrupting process of the drive signal inthe interruption unit on the basis of a result of comparing apredetermined feedback value that is calculated by the feedback signalfrom the encoder with a control calculation value that is calculated ina process in which the motor control unit generates the command valueand is comparable with the predetermined feedback value, wherein thesafety control unit compares a proportional change of the predeterminedfeedback value with a proportional change of the control calculationvalue to determine whether or not to execute the interrupting process onthe basis of a result of the comparison in the interrupting process. 5.A motor control device for driving a motor having an encoder thatdetects an operation of the motor, the motor control device comprising:a motor control unit that generates a command value regarding theoperation of the motor according to a predetermined feedback scheme sothat the operation of the motor follows an operation command signal fordriving the motor on the basis of the operation command signal and afeedback signal from the encoder corresponding to the operation of themotor; a drive unit that supplies a drive current for driving the motorto the motor according to the command value from the motor control unit;an interruption unit that interrupts transfer of a drive signalaccompanying the command value from the motor control unit to the driveunit; and a safety control unit that executes an interrupting process ofthe drive signal via the interruption unit when a determination is madethat a failure has occurred in driving of the motor, wherein the safetycontrol unit executes the interrupting process of the drive signal inthe interruption unit on the basis of a result of comparing apredetermined feedback value that is calculated by the feedback signalfrom the encoder with a control calculation value that is calculated ina process in which the motor control unit generates the command valueand is comparable with the predetermined feedback value, wherein thesafety control unit determines whether or not to execute theinterrupting process on the basis of a proportional change of adifference between a proportional change of the predetermined feedbackvalue and a proportional change of the control calculation value in theinterrupting process.
 6. (canceled)
 7. The motor control deviceaccording to claim 3, wherein the encoder is configured to generate twoindependent feedback signals in response to the operation of the motor,and the safety control unit compares each of the two predeterminedfeedback values calculated from the two feedback signals with thecontrol calculation value and compares the two predetermined feedbackvalues to execute the interrupting process of the drive signal in theinterrupting process.
 8. The motor control device according to claim 4,wherein the encoder is configured to generate two independent feedbacksignals in response to the operation of the motor, and the safetycontrol unit compares each of the two predetermined feedback valuescalculated from the two feedback signals with the control calculationvalue and compares the two predetermined feedback values to execute theinterrupting process of the drive signal in the interrupting process. 9.The motor control device according to claim 5, wherein the encoder isconfigured to generate two independent feedback signals in response tothe operation of the motor, and the safety control unit compares each ofthe two predetermined feedback values calculated from the two feedbacksignals with the control calculation value and compares the twopredetermined feedback values to execute the interrupting process of thedrive signal in the interrupting process.
 10. The motor control deviceaccording to claim 3, wherein a safety circuit board in which the safetycontrol unit is formed is removable from the main body side of the motorcontrol device in which the motor control unit, the drive unit, and theinterruption unit are formed, and the safety circuit board is removedfrom the motor control device, and instead of the safety circuit board,another circuit board in which another safety control unit that isdifferent from the safety control unit has been formed is able to beincorporated in the motor control device, wherein the another safetycontrol unit executes the interrupting process of the drive signalthrough the interruption unit when a determination is made that afailure has occurred in driving of the motor.
 11. The motor controldevice according to claim 4, wherein a safety circuit board in which thesafety control unit is formed is removable from the main body side ofthe motor control device in which the motor control unit, the driveunit, and the interruption unit are formed, and the safety circuit boardis removed from the motor control device, and instead of the safetycircuit board, another circuit board in which another safety controlunit that is different from the safety control unit has been formed isable to be incorporated in the motor control device, wherein the anothersafety control unit executes the interrupting process of the drivesignal through the interruption unit when a determination is made that afailure has occurred in driving of the motor.
 12. The motor controldevice according to claim 5, wherein a safety circuit board in which thesafety control unit is formed is removable from the main body side ofthe motor control device in which the motor control unit, the driveunit, and the interruption unit are formed, and the safety circuit boardis removed from the motor control device, and instead of the safetycircuit board, another circuit board in which another safety controlunit that is different from the safety control unit has been formed isable to be incorporated in the motor control device, wherein the anothersafety control unit executes the interrupting process of the drivesignal through the interruption unit when a determination is made that afailure has occurred in driving of the motor.
 13. The motor controldevice according to claim 7, wherein a safety circuit board in which thesafety control unit is formed is removable from the main body side ofthe motor control device in which the motor control unit, the driveunit, and the interruption unit are formed, and the safety circuit boardis removed from the motor control device, and instead of the safetycircuit board, another circuit board in which another safety controlunit that is different from the safety control unit has been formed isable to be incorporated in the motor control device, wherein the anothersafety control unit executes the interrupting process of the drivesignal through the interruption unit when a determination is made that afailure has occurred in driving of the motor.
 14. The motor controldevice according to claim 8, wherein a safety circuit board in which thesafety control unit is formed is removable from the main body side ofthe motor control device in which the motor control unit, the driveunit, and the interruption unit are formed, and the safety circuit boardis removed from the motor control device, and instead of the safetycircuit board, another circuit board in which another safety controlunit that is different from the safety control unit has been formed isable to be incorporated in the motor control device, wherein the anothersafety control unit executes the interrupting process of the drivesignal through the interruption unit when a determination is made that afailure has occurred in driving of the motor.
 15. The motor controldevice according to claim 9, wherein a safety circuit board in which thesafety control unit is formed is removable from the main body side ofthe motor control device in which the motor control unit, the driveunit, and the interruption unit are formed, and the safety circuit boardis removed from the motor control device, and instead of the safetycircuit board, another circuit board in which another safety controlunit that is different from the safety control unit has been formed isable to be incorporated in the motor control device, wherein the anothersafety control unit executes the interrupting process of the drivesignal through the interruption unit when a determination is made that afailure has occurred in driving of the motor.